GHSA-6mpx-c8rj-whj5: FreeRDP Server before 3.31.0 Use-After-Free via DRDYNVC

Q: Which deployments are exposed?

FreeRDP Server deployments running versions before 3.31.0 are affected. Exploitation targets the server-side DRDYNVC parser and involves AUDIN channel closure handling.

Q: What access does an attacker need?

An attacker must be an authenticated client. They must be able to race AUDIN channel closure messages against DRDYNVC data parsing to cause the server to access a freed channel object.

Q: Is exploitation a simple unauthenticated network attack?

No. The vector is network-based, but the advisory data indicates low privileges are required and attack complexity is high, with an additional attack requirement present.

Published Sep 15, 2026

Updated

FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences a channel pointer after releasing the synchronization lock. Authenticated clients can race AUDIN channel closure messages against DRDYNVC data parsing to trigger heap-use-after-free when accessing freed channel objects.

Affected Software

1 affected component

FreeRDP FreeRDP Server<3.31.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP server to a version that resolves this vulnerability.
Fixed in 3.31.0

Event History

Sep 15, 2026

CVE Published

via OSV·03:18 PM

Data Sourced

via OSV·03:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

FreeRDP Server deployments running versions before 3.31.0 are affected. Exploitation targets the server-side DRDYNVC parser and involves AUDIN channel closure handling.

What access does an attacker need?

An attacker must be an authenticated client. They must be able to race AUDIN channel closure messages against DRDYNVC data parsing to cause the server to access a freed channel object.

Is exploitation a simple unauthenticated network attack?

No. The vector is network-based, but the advisory data indicates low privileges are required and attack complexity is high, with an additional attack requirement present.

GHSA-6mpx-c8rj-whj5: FreeRDP Server before 3.31.0 Use-After-Free via DRDYNVC

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need?

Is exploitation a simple unauthenticated network attack?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need?

Is exploitation a simple unauthenticated network attack?